Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: new rogue-DHCP server malware - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
new rogue-DHCP server malware

Thanks to Irwin for alerting us about a new version of rogue DHCP server malware he found in his network. The malware appears to be similar to Trojan.Flush.M which was found last December. Like back then, after infecting its target, the malware installs a rogue DHCP server. The main goal of the DHCP server is to spread a bad DNS server IP address.

Irwin did a good job comparing the two versions. Here is his summary of the differences:

  • The new version sets the DHCP lease time to 1 hour.
  • it sets the MAC destination to thebroadcast address, rather then the MAC address of the DHCP client
  • it does not specify a DNS Domain Name.
  • the options field does not contain an END option followed by PAD options.
  • Unlike Trojan.Flush.M, the BootP Broadcast Bit is set.

The malicious DNS server is 64.86.133.51 and 63.243.173.162.

Recommendation:

monitor connections to DNS servers other then the approved one pushed out by your DHCP server. This should help you spot this kind of malware. Yes, you can block the two IP addresses listed above, but it will likely do little good.

 

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

I will be teaching next: Intrusion Detection In-Depth - SIEM Summit & Training 2019

Johannes

3631 Posts
ISC Handler
Any update to this? How can it be identified (file, registry, etc)? I have quarantined a machine I believe to contain this malware, however I want to be certain.
Anonymous
How would one monitor connections to DNS servers other then the approved one? A mirrored port and a sniffer? Wireshark? Educate us further please.
Michael

32 Posts
My advice is to use your own internal DNS servers, then block port 53 outbound from any computer on your network that is not a DNS server.

Most firewalls will allow for email alerts if a rule is triggered, this would be a great one to use that feature for. If any computer tries to get to a DNS server that isn't one of your internal ones, you'll know it is either infected, misconfigured, or someone is playing with nslookup.
Jason

9 Posts
To locate the invalid DHCP server, obtain a copy of the DHCP Server Locator Utility (DHCPLoc.exe) from Windows support tools.

These are included on OS install CDs (\\Support\\Tools).
http://technet.microsoft.com/en-us/library/cc758202.aspx

You can download XPs here (this .exe will work on Server 03 and Vista also):
http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en

DHCPLoc Overview:
http://technet.microsoft.com/en-us/library/cc778483.aspx

Syntax for this purpose:

dhcploc /p ThisComputerIPAddress ValidDHCPServerIP

The output will be:
Time (IP)ThisComputerIPAddress OfferedPacketType (S)DHCPServerIPAddressResponding [***]

[***] outputs if it detects an unauthorized server.

FYI - Symantec has write ups on earlier versions of this as Trojan.Flush.M and OSX.RSPlug.A
This newer variant (w/these new rouge DNS) is listed as W32.Tidserv.G (as a variant of W32.Tidserv)
http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2
Jason
2 Posts
Let's try this again
<BR><BR>
To locate the invalid DHCP server, obtain a copy of the DHCP Server Locator Utility
(DHCPLoc.exe) from Windows support tools.<BR><BR>
These are included on OS install CDs (SupportTools).
http://technet.microsoft.com/en-us/library/cc758202.aspx
<BR><BR>
You can download XPs here which this exe will also work on server and vista too:
http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en
<BR><BR>
DHCPLoc Overview:
http://technet.microsoft.com/en-us/library/cc778483.aspx
<BR><BR>
Syntax for this purpose:
<BR><BR>
dhcploc /p ThisComputerIPAddress ValidDHCPServerIP
<BR><BR>
The output will be:
Time (IP)ThisComputerIPAddress OfferedPacketType (S)DHCPServerIPAddressResponding [***]
<BR><BR>
[***] outputs if it detects an unauthorized server.
<BR><BR>
FYI - Symantec has write ups on earlier versions of this as Trojan.Flush.M and OSX.RSPlug.A
This newer varient is listed as W32.Tidserv.G (as a variant of W32.Tidserv)
http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2
Jason
2 Posts

Sign Up for Free or Log In to start participating in the conversation!